By requiring hardware attestation, like Private Access Tokens in iOS/MacOS (see https://blog.cloudflare.com/eliminating-captchas-on-iphones-... for example) and Web Environment Integrity and its successors ( https://github.com/explainers-by-googlers/Web-Environment-In... ).